Security model¶
joinstr has no trusted coordinator, so every peer protects themselves. Your coin can only be spent by a transaction you signed and your client only signs one that pays you your output.
Assumptions¶
- Relays can drop, delay or replay events, but cannot read encrypted pool messages or forge signatures.
- Any peer, including the pool creator, may be malicious.
- Your wallet backend (Electrum server or Bitcoin Core) reports your own coins honestly.
Checks before signing¶
A peer signs only after these checks pass.
| Check | Stops |
|---|---|
| The pool announcement is signed by the pool key it names | Fake or altered pool announcements |
| Credentials carry the private key of the announced pool and the same terms | Someone other than the creator handing out credentials or changing the terms |
| Your output is in the transaction with the computed amount | A round that does not pay you |
| Your cost is at most 15000 sats and your output is above dust | A creator draining joiners with an extreme fee rate |
| Your input does not cover all outputs on its own | A registration PSBT that someone could broadcast alone, spending your whole coin to pay every output |
| Your coin is one the wallet considers spendable | Spending frozen or locked coins |
Checks before broadcast¶
| Check | Stops |
|---|---|
| All outputs are equal and there is one per peer | Unequal outputs that would break the anonymity set |
| No output address repeats and no input address appears as an output | Address reuse that links coins |
| No two inputs spend from the same address | Inputs that link to each other |
| Total fee is between 100 and 10000 sats per peer | Transactions that overpay or would not confirm |
Denial of service¶
An attacker can join a pool and never sign, so that the round stalls. joinstr limits this in three ways.
- Ring signature recovery. Honest peers who signed can finish without the missing peers. See recovery.
- aut-ct. A pool can require each peer to prove ownership of a coin from a keyset, so filling seats costs real coins. See Sybil resistance.
- Relay choice. A pool runs on one relay chosen by the creator. Paid or private relays raise the cost of spam.
Known limits¶
- A pool creator learns nothing more than other peers, but can choose a relay that logs timing.
- A relay can refuse to carry a pool's events. The pool then fails and no coins move.
- Peers who drop out after registering an output cost honest peers time, even when recovery succeeds.
Reporting vulnerabilities¶
See the security policy.